vdmp.h

Go to the documentation of this file.

#define VDM_APP_MODE            0x00000001L
#define VDM_INTERRUPT_PENDING   0x00000002L
#define VDM_STATE_CHANGE        0x00000004L
#define VDM_VIRTUAL_INTERRUPTS  0x00000200L
#define VDM_PE_MASK             0x80000000L

typedef enum _VdmEventClass {
    VdmIO,
    VdmStringIO,
    VdmMemAccess,
    VdmIntAck,
    VdmBop,
    VdmError,
    VdmIrq13
} VDMEVENTCLASS, *PVDMEVENTCLASS;

typedef struct _VdmIoInfo {
    USHORT PortNumber;
    USHORT Size;
    BOOLEAN Read;
} VDMIOINFO, *PVDMIOINFO;

typedef struct _VdmStringIoInfo {
    USHORT PortNumber;
    USHORT Size;
    BOOLEAN Read;
    ULONG Count;
    ULONG Address;
} VDMSTRINGIOINFO, *PVDMSTRINGIOINFO;

typedef ULONG VDMBOPINFO;
typedef NTSTATUS VDMERRORINFO;

typedef struct _VdmEventInfo {
    ULONG Size;
    VDMEVENTCLASS Event;
    ULONG InstructionSize;
    union {
        VDMIOINFO IoInfo;
        VDMSTRINGIOINFO StringIoInfo;
        VDMBOPINFO BopNumber;
        VDMERRORINFO ErrorStatus;
    };
} VDMEVENTINFO, *PVDMEVENTINFO;

typedef struct _Vdm_InterruptHandler {
    USHORT  CsSelector;
    ULONG   Eip;
    USHORT  SsSelector;
    ULONG   Esp;
} VDM_INTERRUPTHANDLER, *PVDM_INTERRUPTHANDLER;

typedef struct _Vdm_Tib {
    ULONG Size;
    ULONG Flags;
    VDM_INTERRUPTHANDLER VdmInterruptHandlers[255];
    CONTEXT MonitorContext;
    CONTEXT VdmContext;
    VDMEVENTINFO EventInfo;
} VDM_TIB, *PVDM_TIB;

NTSTATUS
NtStartVdmExecution(
    );

// Flags that don't belong here

#define SEL_TYPE_READ       0x00000001
#define SEL_TYPE_WRITE      0x00000002
#define SEL_TYPE_EXECUTE    0x00000004
#define SEL_TYPE_BIG        0x00000008
#define SEL_TYPE_ED         0x00000010
#define SEL_TYPE_2GIG       0x00000020

---